Fault-tolerant aircraft flight control using a subset of aerodynamic control surfaces

ABSTRACT

A method for controlling an unmanned aerial vehicle (UAV) is described. In one example, the method includes: detecting, by one or more processors of a controller within a UAV, whether flight control surfaces of the UAV are operating nominally; switching, by the one or more processors of the controller, in response to detecting that one or more of the flight control surfaces of the UAV are not operating nominally, to implementing a backup control mode configured to operate the UAV in flight with non-nominal operability of one or more of the control surfaces of the UAV; and operating, by the one or more processors of the controller, the UAV in the backup control mode.

This application claims the benefit of U.S. Provisional Application No.62/344,088 by Venkataraman, entitled, “FAULT-TOLERANT AIRCRAFT FLIGHTCONTROL USING A SUBSET OF AERODYNAMIC CONTROL SURFACES” and filed onJun. 1, 2016, the entire content of which is incorporated herein byreference.

GOVERNMENT INTEREST

This invention was made with government support under NSF/CNS-1329390awarded by the National Science Foundation. The government has certainrights in the invention.

TECHNICAL FIELD

The invention relates to aircraft flight control systems.

BACKGROUND

Recently, unmanned aerial vehicles/systems (UAVs/UASs) have foundincreasing civilian and commercial applications, such as lawenforcement, search and rescue, and precision agriculture. Thesecommercial applications require UAVs to operate in civilian airspace.Central to operating UAVs in civilian airspace is the challenge ofmeeting the stringent safety standards set by the Federal AviationAdministration (FAA). In 2012, the United States Congress passedH.R.658—the FAA Modernization and Reform Act—in order to facilitate thesafe integration of UASs into the national airspace. In particular,section 332 of H.R.658 mandates the FAA to “provide for the safeintegration of civil unmanned aircraft systems into the nationalairspace system as soon as practicable, but not later than Sep. 30,2015.” In August 2016, the FAA's Final Rule for 14 CFR Part 107 becameeffective and laid out rules for UAS operators to follow. This brings inlegislative and policy dimensions to what is academically seen as atechnical challenge.

To put this challenge in perspective, consider the current safetystandards set by the FAA for manned commercial aircraft. In order for amanned commercial aircraft to be certified, there should be no more thanone catastrophic failure per 10⁹ flight hours. Commercial aircraftmanufacturers, such as Boeing, meet the 10⁻⁹ failures-per-flight-hourstandard by utilizing hardware redundancy. For example, the Boeing 777has 14 spoilers each with its own actuator: two actuators each for theoutboard ailerons, left and right elevators, and flaperons; and threeactuators for the single rudder. On the other hand, most civil UAVs havereliabilities that are orders of magnitude below the standard of 10⁻⁹failures-per-flight-hour. For instance, the UAV Research Group at theUniversity of Minnesota (UMN) operates an Ultra Stick 120 aircraft(described further below) with single-string, off-the-shelf components.A comprehensive fault tree analysis yielded a failure rate of 2.2×10⁻²failures-per-flight-hour for this aircraft.

UAVs have such low reliability for two main reasons. First, moston-hoard components are not very reliable because they are low-cost.Second, most on-board components have little to no hardware redundancy.Consequently, there are single points of failure that can lead tocatastrophic failure. Safe integration of UAVs into the nationalairspace requires increases in UAV reliability. However, the solutionsadopted to increase the reliability of manned commercial aircraft arenot downwardly scalable to UAVs, in particular, hardware redundancy mustbe used judiciously because of the costs associated with size, weight,and power. Analytically redundant solutions, such as robust andfault-tolerant control, have the potential to bridge the gap betweencommercial aircraft, that almost entirely use hardware redundancy, andcurrent UAVs, that are almost entirely single-string designs.

SUMMARY

In general, examples of this disclosure provide control systems andmethods for UAVs to operate successfully with reduced control authorityor reduced control of control surfaces, such as if actuation fails onone or more of the aerodynamic control surfaces. In some examples, acontrol system of this disclosure may use a Linear Quadratic Gaussian(LQG) control law implementation that accounts for control failures ofone or more control surfaces and implements a backup control mode withre-assigned parameters or weights to the parameters of an LQG controllaw that may successfully maintain the UAV in flight with as little asone remaining operable control surface. A system of this disclosure maybe configured to normally operate the UAV in a standard control mode,detect when the UAV suffers a control failure of one or more controlsurfaces, and respond to detecting the control failure by switching theUAV control mode from the standard control mode to the backup controlmode.

Civil unmanned aircraft will need to meet stringent safety standardsbefore they are certified to operate in the national airspace of theUnited States. Reliability is a key requirement for certification. Mostcurrent civil unmanned aircraft are not reliable because of the presenceof single points-of-failure and the use of low-reliability components.For example, many fixed-wing unmanned aircraft are equipped with onlytwo aerodynamic control surfaces. A fault in any one surface willusually spell catastrophe. Systems of this disclosure may eliminate thissingle point-of-failure using multi-variable control laws. A singleaerodynamic control surface is shown to be sufficient to stabilize theaircraft arid execute a set of limited maneuvers. These limitedmaneuvers are sufficient to safely fly to a landing spot. This conceptwas proved using flight tests on an unmanned aircraft at the Universityof Minnesota. The results are also applicable to manned commercialaircraft. Controllability with one surface indicates the large potentialto mitigate faults that might otherwise lead to loss-of-control events.

The techniques of this disclosure describe technical improvements thatallow a controller to safely fly an aircraft with only one functionalaerodynamic control surface. Accordingly, a two-surface UAV implementingthe techniques described within can be made fault-tolerant up to onecontrol surface. In one example, a system uses robust, multivariablefeedback control laws to provide single-surface fault-tolerance forcontrolling, flying, and/or landing a two-surface UAV. Thus, such asystem as described herein may reduce or eliminatesingle-points-of-failure in many types of aircraft, such as atwo-surface UAV. Further, such a system as described herein may provideadditional redundancy and increased safety for control surfaces ofaircraft. Further, such a system as described herein may allow for thereduction of redundant parts, allowing for reduced cost of manufactureand operation.

In one embodiment, the invention is directed to a method that includesdetecting, by one or more processors, whether flight control surfaces ofan aircraft are operating nominally. The method further includesswitching, by the one or more processors, in response to detecting thatone or more of the flight control surfaces of the aircraft are notoperating nominally, to implementing a backup control mode configured tooperate the aircraft in flight with non-nominal operability of one ormore control surfaces of the aircraft. The method further includesoperating, by the one or more processors, the aircraft in the backupcontrol mode.

In another embodiment, the invention is directed to a system configuredto detect whether flight control surfaces of an aircraft are operatingnominally. The system is further configured to switch, in response todetecting that one or more of the flight control surfaces of theaircraft are not operating nominally, to implementing a backup controlmode configured to operate the aircraft in flight with non-nominaloperability of one or more control surfaces of the aircraft. The systemis further configured to operate the aircraft in the backup controlmode.

In another embodiment, the invention is directed to a computer-readablemedium containing executable instructions. The instructions cause aprogrammable processor to detect whether flight control surfaces of anaircraft are operating nominally. The instructions further cause theprogrammable processor to switch, in response to detecting that one ormore of the flight control surfaces of the aircraft are not operatingnominally, to implementing a backup control mode configured to operatethe aircraft in flight with non-nominal operability of one or morecontrol surfaces of the aircraft. The instructions further cause theprogrammable processor to operate the aircraft in the backup controlmode.

The details of one or more embodiments of the invention are set forth inthe accompanying drawings and the description below. Other features,objects, and advantages of the invention will be apparent from thedescription and drawings, and from the claims.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is an illustration of a two-control-surface UAV.

FIGS. 2A-2B are illustrations, with superimposed labels, of two views(FIG. 2A and FIG. 2B) of a UAV in accordance with example aspects ofthis disclosure.

FIG. 3 depicts a conceptual block diagram of a Linear Quadratic Gaussian(LQG) control law implementation in accordance with example aspects ofthis disclosure.

FIG. 4 depicts a conceptual block diagram of an H₂₈ control lawimplementation with generalized plant interconnection in accordance withexample aspects of this disclosure.

FIG. 5 depicts graphs of a flight test with an LQG controller for threestraight and level flights in accordance with example aspects of thisdisclosure.

FIG. 6 depicts graphs of a flight test with an LQG controller for threeleft banked turns in accordance with example aspects of this disclosure.

FIG. 7 depicts graphs of a flight test with an H_(∞) controller for twostraight and level flights in accordance with example aspects of thisdisclosure.

FIG. 8 depicts graphs of a flight test with an H_(∞) controller for tworight banked turns in accordance with example aspects of thisdisclosure.

FIG. 9 depicts a flowchart for a method that may be performed by anaircraft control system in accordance with example aspects of thisdisclosure.

FIG. 10 is an illustration of example control circuitry of an aircraftin accordance with the techniques of the disclosure.

DETAILED DESCRIPTION

Examples described herein demonstrate the possibility of safely flying afixed-wing aircraft with only one aerodynamic control surface. Tomotivate this result, consider a typical two-surface UAV, pictured inFIG. 1.

FIG. 1 is an illustration of a two-control-surface UAV. In one example,the UAV is a Sentera Vireo 100. A two-control-surface UAV has a pair ofelevons that provide roll and pitch control authorities. Normally, bothelevons are mission-critical. In other words, a failure in either elevonleads to loss of mission (LOM). However, if the aircraft is notfault-tolerant, both elevons become safety-critical. A safety-criticalcomponent is one whose failure eventually leads to loss of control (LOC)and catastrophic failure. In addition to being safety-critical, the twoelevons are also individual single-points-of-failure intwo-control-surface UAVs such as the Vireo. In other words, a singlefailure in either elevon is all it takes to cause catastrophic failure.This disclosure describes example implementations in which a controllermay apply advanced feedback control techniques to make even atwo-surface UAVs tolerant to faults in either control surfac In otherwords, technical improvements are described herein by which a controllermay control return flight and landing of a UAV even if only a singlecontrol surface is operational.

All the example two-surface UAVs described herein are used for aerialsurveillance and mapping. After a control surface failure, the missionis degraded to safely flying home. In order to safely fly home, theaircraft should he able to execute a limited set of maneuvers. Thisincludes, at the very least, straight and level flight at constantaltitude, either left or right banked turns, and steady descents.

As described herein, control circuitry 101 of UAV 101 functions as anaircraft control system to generate a flight path to a safe landing spotusing combinations of these canonical maneuvers. Furthermore, controlcircuitry executes the limited set of maneuvers described above usingthe control techniques described herein to safely control UAV 101,return home, and land the aircraft. Various results presented belowdemonstrate the execution of these canonical maneuvers based on thecontrol techniques described herein,

FIGS. 2A-2B are illustrations, with superimposed labels, of two views(FIG. 2A and FIG. 2B) of a UAV 200 in accordance with example aspects ofthis disclosure. In one example, the UAV is based on an eight-controlsurface Ultra Stick 120 UAV airframe. The Ultra Stick 120 is acommercial, off-the-shelf, radio-controlled aircraft with a wingspan of1.92 meters and a mass of about 8 kilograms (kg). The airframe of UAV200 has been retrofitted with custom avionics for real-time control,guidance, navigation, and fault detection in accordance with thetechniques of the disclosure. The avionics include a sensor suite, aflight control computer, and a telemetry radio. However, the techniquesof the disclosure may be performed on UAVs with other numbers of controlsurfaces, such as a two-control surface UAV.

In some examples, UAV 200 has a total of eight aerodynamic controlsurfaces, each actuated by its own servo motor. These surfaces arelabeled in FIG. 2 as flaps (F_(1,2)), ailerons (A_(1,2)), elevators(E_(1,2)), and rudders (R_(1,2)). The split elevators and rudders arecustom modifications that are unique to the example of UAV 200 of FIG.2. The sign convention of the control surfaces is as follows. A trailingedge down deflection of the elevators, ailerons, and flaps is consideredpositive. A trailing edge left deflection of the rudders, when viewedtop-down, is considered positive. In addition, all the surfaces have adeflection range of [−25°, +25]. While each surface is independentlyactuated, the flight software allows for them to be coupledsymmetrically (such as the elevators) or anti-symmetrically (such as theailerons). While UAV 200 may appear to be over-actuated for a small UAV,the flight software allows the control designer to choose the specificsurfaces that are to be controlled. Moreover, these redundant surfacesallow for the testing and validation of fault-tolerant andreconfigurable control laws. Such redundant surfaces serve as atechnology demonstrator for refinement and testing of the techniques ofthe disclosure. From an infrastructure standpoint, this aircraft servesas the test platform for some of the safety-critical and aircraftreliability research that is being undertaken by the UMN UAV ResearchGroup.

A high-fidelity simulation environment for the Ultra Stick 120 ispublicly available. This simulation environment was built usingMatlab/Simulink and contains models for the aircraft subsystems. Therigid body dynamics are implemented using the standard sixdegree-of-freedom, nonlinear aircraft equations of motion. Theaerodynamic stability and control derivatives were identified from windtunnel experiments. The simulation models the forces and moments and thepropeller wash generated by the electric motor and propeller pair. Thesimulation also includes actuator models for the servo motors and sensormodels for the inertial measurement unit (IMU), air data probes, andmagnetometer. Environmental effects, such as wind gusts, atmosphericturbulence, and the Earth's gravitational and magnetic fields aremodeled using subsystems. The nonlinear aircraft model can be trimmedand linearized at any flight condition within the flight envelope of theaircraft. The simulation environment and the flight control computerallow for extensive software-in-the-loop and hardware-in-the-loopsimulations.

Experimental flight tests were conducted on UAV 200 to demonstrate safeflight using only one control surface. Because UAV 200 is equipped witheight control surfaces, control circuitry 101 (e.g., the flightcomputer) is used to select the single surface to be actuated. Thissingle surface must have sufficiently high roll and pitch controlauthorities. The only surfaces that qualify for this challenge are theleft and right elevators (E1 and E2 in FIG. 2B). The ailerons, flaps,and rudders have negligible pitch control authority. UAV 200 isrepresentative of conventional airframes with a fuselage and empennage.In addition, by employing the split elevators as elevons, UAV 200 canalso act like a two-surface UAV. Therefore, demonstrating safe flight onUAV 200 with only the left or right elevator should be a good indicatorof whether the same is possible on larger conventional aircraft as wellas on smaller two-surface UAVs, such as UAV 100 of FIG. 1.

Irrespective of the type of aircraft that is being emulated, theaircraft may operate in a baseline control mode when all surfaces arehealthy. Various implementations of fault-tolerant control in accordancewith this disclosure may include a baseline or standard control modeimplementation, a fault detection and isolation (FDI) system (e.g., anFIN algorithm executed by an appropriate processor with appropriatesensor inputs), a backup or reduced control mode, and a transitionsystem to switch between the baseline and backup control modes. Any ofvarious FDI algorithms may be used with a backup control modeimplementation of this disclosure. The FDI system may serve as areal-time fault detection device, and switch the aircraft from thestandard or baseline operating mode to the backup or reduced-functionoperating mode. The transition system may include a simple instantaneousswitch from the baseline control mode to the backup control mode.

When the backup or reduced-function operating mode activates or takesover operation of the aircraft from the standard or baseline operatingmode, the backup operating mode may effectively detect specificallywhich control surfaces are and are not operational, and what the stateis of the failed one or more control surfaces. The FDI algorithm mayperfomi functions of isolating a faulty control surface, and the FDIalgorithm and/or the backup control law together may providefault-tolerance. The backup control mode may then determine andimplement a new set of weighting parameters for the aircraft controller,such as new weighting parameters for roll rate p, pitch rate q, and yawrate r, or another set of weighting parameter variables, so as tocompensate for the failure modes of the one of more faulty controlsurfaces, and to maintain controlled flight of the aircraft, as furtherdescribed below.

The backup control mode may also incorporate a mathematical model of thespecific aircraft it is controlling. The mathematical model of thespecific aircraft may effectively describe the physical parameters ofthe aircraft and its dynamical response to the actuation of itsaerodynamic control surface(s) and power producing unit(s), such aselectric motors. The mathematical model of the aircraft may be used inrevising its operating regime and in modifying the controllerparameters. The backup control mode may further incorporate a model ofthe detected trim state of the aircraft. That is, the backup controltriode may incorporate a model of the detected faulty state of the oneor more failed control surfaces, such as whether one or more elevators,ailerons, flaps, or rudders is stuck or otherwise under reduced control;and how those one or more failed control surfaces is faulty, such as ifthe control surface is stuck at a certain angle, for example. The backupcontrol mode may use the model that incorporates the state of the one ormore failed control surfaces as well as the state of one or moreremaining fully functional control surfaces in determining thecontroller parameters to be applied. In this way, the backup controlmode controls the one or more remaining functional control surfaces tooperate the aircraft in flight.

The backup control mode may take into account inputs from each of thecontrol surfaces of the aircraft, and the effect that the state of eachof those control surfaces has on each of the degrees of freedom of theaircraft. The complete possible sets of control surface states maydefine a superset of models of the possible states of the aircraft andits potential operating states. The backup control mode may respond tothe detection of a faulty one or more control surfaces by detecting andimplementing an operating state, from within that superset of possibleoperating states, that corresponds to the detected reduced functionalitystate of the aircraft.

In other words, the backup control mode may take into account the effectthat each of the control surfaces of the aircraft, and their respectivestates of operation, has on each of the degrees of freedom of theaircraft. By using the mathematical model of the aircraft and thedetected trim state, the backup control mode may create a superset ofall possible operating states of the aircraft and a simplifiedmathematical description of the behavior of the aircraft at each of thepossible operating states. Moreover, the backup control mode may containcontroller parameters at each of the possible operating states, againforming a superset of controllers. The backup control mode may respondto the detection of one or more faulty control surfaces by implementingan operating state and controller, from within that superset of possibleoperating states and controllers, that corresponds to the detectedreduced functionality state of the aircraft.

Illustrative examples of the backup control mode selecting from thesuperset of possible operating states are presented below with referenceto certain simplified special cases of failure modes. Various resultsare presented below are directed to a scope of failure modes limited intwo specific ways, for purposes of simplified analysis, though otherexample implementations may detect and act to resolve any other types ofcontrol surface failures. In the selected special case failure modesconsidered below, first, only instantaneous stuck actuator faults areconsidered. This assumption disregards dynamic actuator fault modes,such as oscillatory and ramp failures, Second, the actuators are assumedto get stuck at their respective trim positions. In other words, onlyfault modes that do not alter the trim point are considered. While thesetwo assumptions may seem overly restrictive, it is a good starting pointfor a technology demonstration exercise. In order to make this scoperigorous and set the stage for control design (further below), somemathematical preliminaries are introduced below.

The aircraft equations of motion can be described in the nonlinearstate-space thrill, as shown in equations 1 and 2.

{dot over (x)}=f(x, u, t)   (1)

y=h(x, u, t)   (2)

In this form, x∈

^(n) is the state vector, u∈

^(m) is the input vector, y∈

^(p) is the output vector, and t∈

⁺ is time. In addition, f:

^(n)×

^(m)→

^(n) is the state function and h:

^(n)×

^(m)→

^(p) is the output function. The state vectoris:x=[φ,θ,p,q,r,u,v,w]^(T). Here, φ and θ are two of the Euler angles ofthe aircraft. The third Euler angle (ψ), is not included in the statevector because only inner loop controllers are developed in thisdisclosure. The aircraft's angular velocity in the body-fixed frame are:roll rate (p), pitch rate (q), and yaw rate (r). The airspeed componentsin the body-fixed frame are u, v, and w. It is mentioned above that onlythe left and right elevators qualify for the challenge of single surfaceflight. Consequently, the input vector is:u=[τ,E₁,E₂]^(T). Here, τ isthe throttle setting and E₁ and E₂ are the deflections of the left andright elevators, respectively. The output vector (y) contains some newvariables in addition to those in the state vector (x). The airspeed,angle of attack, angle of sideslip, and flight path angle are denoted byV, α, β, and γ, respectively.

Aircraft typically fly around equilibrium or trim points. These areoperating points at which sonic state derivatives are zero, and othershave constant values. The collection of all such trim points defines thesteady flight envelope (

) of the aircraft, as shown in equation 3.

={( x, ū): f( x,ū)=0}  (3)

The limited set of maneuvers described above can be described as subsetsof

, as given in equations 4 through 6. Banked right turns have a formsitnilar to equation 6, except that φ>0.

_(straight,level)={( x,ū)∈

: p=q=r=φ=γ=0}  (4)

_(steady,descent)={( x,ū)∈

: p=q=r=φ=0,γ<0}  (5)

_(banked,left)={( x,ū)∈

:φ<0,γ=0}  (6)

The scope of demonstration can now be mathematically defined. Consider,for example, a stuck fault in the right elevator (E₂) that occurs attime T_(f). Moreover, let the trim deflection be Ē₂. The assumptionsimply that E₂(t≧T_(f))≡Ē₂. When the same assumption is applied to allthe stuck surfaces, it is seen that the trim point (x,ū) is unaltered bythe control surface faults. This simplification serves well todemonstrate the proof of concept in this disclosure. In particular, thesteady state of the aircraft is unaltered, implying that the actuatorfaults induce small transients in the aircraft states. These smalltransients make the switchover from the baseline control mode to thebackup control mode relatively smooth and stable. However, it isacknowledged that a rigorous demonstration will involve relaxing theseassumptions to include dynamic actuator faults as well as trim pointvariations. The main impact of relaxing these assumptions will be largertransient effects in the aircraft states after the onset of the faults.These transient effects will have to be effectively managed by thebackup controller. Controllers that have enhanced robustness and thosethat explicitly depend on the operating point, such as linear parametervarying (LPV) controllers, are promising solutions.

Fault-Tolerant Control Synthesis in terms of a linear aircraft model aredescribed as follows. The nonlinear aircraft model is linearized aboutthe nominal trim point for applying linear control synthesis techniques.The linearized aircraft model has a state-space representation shown inequations 7 and 8.

{dot over ({tilde over (x)})}=A{tilde over (x)}+Bũ  (7)

{tilde over (y)}=C{tilde over (x)}+Dũ  (8)

The linearized dynamics are written in terms of the perturbationquantities: {tilde over (x)}, ũ, and {tilde over (y)}. The total signalis the sum of the trim and perturbation components. For example,x=x+{tilde over (x)}. Throughout the remainder of this section, thetilde will be dropped from the perturbation components of the linearmodel.

For demonstration in one example, the left elevator E₁ may be the onlycontrollable surface. The corresponding input vector is u=E₁. It shouldbe noted that, in general, the throttle can also be used forfault-tolerant control. The state vector is the same as before:x=[φ,θ,p,q,r,u,v,ω]^(T). The output vector is y=[φ,θ,p,q,r], andcontains all the measured and estimated signals used for feedbackcontrol. The angular rates in the body-fixed frame (p; q; r) aredirectly measured by a strap-down IMU of UAV 200—the only sensor in thisexample that is used for feedback control in this disclosure. The Eulerangles (φ, θ) are estimated using a fifteen-state extended Kalman filter(EKF). The linear accelerations (αx; αy; αz) from the strap-down. MU arenot used in feedback because of the presence of biases. Although thesebiases can be easily estimated using the EKF, this is not done in thisexample, for the sake of simplicity. Given this output vector, onlyinner loop controllers are developed. The nominal trim point of UAV 200and the linear aircraft model P are described below. This linear model Pcan be shown to be both controllable and observable using the Kalmanrank test. In addition, a balanced realization of the linear model P hasthe following Hankel singular values: [9.44; 4.93; 3.4; 1.72; 0.59;0.06; 0.02, 0.02]. This indicates that some states are much morecontrollable and observable than others. However, this is notparticularly problematic in the control synthesis.

The baseline control mode for UAV 200 is a classical loop-at-a-timedesign. in this design, the longitudinal and lateral-directionalaircraft dynamics are assumed to he decoupled. Hence, separate loops aredesigned for each dynamics. The longitudinal loop controls the throttleand elevators. The lateral-directional loop controls the ailerons andrudders. Flaps may be pilot-controlled. Each control loop has aclassical cascade structure with inner and outer loops. The backupcontrol mode laws are synthesized using multi-variable control theoryand are based on the linear aircraft model parameters described below.As described, the backup control laws implemented by the control systemsdescribed herein are designed to actuate only the non-failing controlsurface (left elevator (E₁) in this example) while locking all theremaining surfaces (i.e., the failed control surfaces) into theirrespective trim positions. A multi-input-multi-output (MIMO) approachmay be necessary for synthesizing the backup control laws because theleft elevator excites both the longitudinal and the lateral-directionaldynamics.

Linear quadratic Gaussian (LQG) control for the backup control mode isdescribed as follows. The first backup control mode law is an LQGdesign, shown by the dashed box K_(LQG) in FIG. 3 as described below.

FIG. 3 depicts a conceptual block diagram of a Linear Quadratic Gaussian(LQG) backup control mode system 300 in accordance with example aspectsof this disclosure. LQG controllers are primarily used for outputregulation around the trim point. However, in order to demonstratecommand tracking, integrators can be added to specific output channels.In this disclosure, the LQG control mode law regulates roll, pitch, andyaw rates p; q; r around zero and tracks roll and pitch referencecommands. The controller K_(LQG) 302 has a two degrees-of-freedomstructure: one for the reference commands r and the other for themeasurements y. The LQG controller has three parts internally (not shownin FIG. 3): a total feedback gain, a Kalman filter, and integrators. Thetotal feedback gain is composed of the optimal state feedback gain(K_(sf)) as well as the integral gain. The state feedback gain has asize compatible with the state vector. The controller K_(LQG) 302generates an output and provides the output to a linear model P 304,which also receives an input for a process noise signal (w). The linearmodel P 304 generates an output, which is combined with a measurementnoise signal (v). That combination is provided as the output of the LQGcontrol mode system 300, and is fed back as an input to controllerK_(LQG) 302. Controller K_(LQG) 302 also receives reference commands (r)as an input.

The state feedback law u=K_(sf){circumflex over (x)} minimizes thefollowing quadratic cost function,

J(x ₀ ,u)=∫₀ ^(∞)({circumflex over (x)} ^(T) Q{circumflex over (x)}+u^(T) Ru)dt,   (9)

subject to the system dynamics given in equation 7. In equation 9,{circumflex over (x)} is the estimated state vector and x₀ is theinitial condition at t=0. The state feedback gain K_(sf) is obtained bysolving an associated algebraic Riccati equation. A Kalman filter isused to provide the state estimates ({circumflex over (x)}) to the statefeedback law. The Kalman filter has access to sensor measurements (y)and control commands (u).

In some examples, the backup control mode may use a Kalman filter tominimize the steady-state covariance of the error in the stateestimates, in accordance with: lim_(t→∞) E[(x−{circumflex over(x)})(x−{circumflex over (x)})^(T)]. By acting to minimize thesteady-state covariance of the error in the state estimates in this way,the backup control mode may operate the remaining functional controlsurfaces in such a way as to effectively reduce or minimize theaircraft's impairment in maintaining controlled flight. By minimizingthe steady-state covariance of the state estimation error, the Kalmanfilter provides the backup control mode with the best estimate of thestate vector of the aircraft. The backup control mode then uses the bestestimate of the aircraft state to control the remaining operablesurfaces in a way to maintain the aircraft in flight despite the one ormore control surface failures.

FIG. 3 also shows process noise (w) and measurement noise (v) signals.The covariance of these signals are used in the synthesis of the Kalmanfilter.

The controller K_(LQG) also contains integrators for tracking roll andpitch reference commands, supplied as: =[φ_(cmd), θ_(cmd)]^(T). Thetracking error (e) is formed between r and the estimated Euler anglesas: e=r−[φ,θ]^(T). The tracking error is integrated over time and thenmultiplied by the integral gain. Example metrics are depicted below thatdescribe the robustness of the LQG control law to uncertainties in theaircraft model. The LQG control mode law has limited objectives:regulating p; q; r around zero and tracking φ_(cmd) and θ_(cmd).

LQG backup control mode system 300 may be implemented in a hardwareblock that includes one or more processors, which may include anygeneral logic processing elements, and various input elements and outputelements. A flight controller of a UAV, such as flight controller 101 ofUAV 100 of FIG. 1, that implements such an LQG backup control modesystem 300 may thus perform or embody a method that may includedetecting whether flight control surfaces of an aircraft are operatingnominally; switching, in response to detecting that one or more of theflight control surfaces of the aircraft are not operating nominally toimplement an LQG backup control mode configured to operate the aircraftin flight with non-nominal operability of one or more control surfacesof the aircraft; and operating the aircraft in the backup control mode.

In some examples, the flight controller may also detect a trim state ofthe one or more of the flight control surfaces of the aircraft are notoperating nominally; and incorporate the detected trim state of the oneor more of the flight control surfaces of the aircraft that are notoperating nominally in the reduced flight control surface operabilitycontrol mode (e.g., as input to LQG backup control mode system 300). Theflight controller may implement the backup control mode by modifying theparameters of the flight controller based on a linear quadratic Gaussian(LQG) design (e.g., based on output of LQG backup control mode system300).

The flight controller may implement LQG backup control mode system 300by using a Kalman filter to minimize steady-state covariance of error instate estimates of a linearized aircraft model in a state-spacerepresentation. Using the Kalman filter to minimize the steady-statecovariance of the error in the state estimates may include determiningan optimization in accordance with the following function:

${minimize}( {\lim\limits_{tarrow\infty}{E\lbrack {( {x - \hat{x}} )( {x - \hat{x}} )^{T}} \rbrack}} )$

The resulting Kalman filter may be part of the larger LQG backup controlmode system 300.

Operating the aircraft in the backup control mode may includeimplementing a return and land procedure for the aircraft. The controlsystems of the aircraft may also initially operate the aircraft in astandard control mode, and may perform detecting whether the flightcontrol surfaces of the aircraft are operating nominally at least onceduring operating the aircraft in the standard control mode.

In order to incorporate multiple control objectives and enhance thedisturbance rejection properties of the closed loop, another exampleinvolving H_(∞)control is also described below. The second examplebackup control mode law in this disclosure is an H_(∞) design thatallows for multiple design objectives to be specified. A generalizedplant with all the weighting functions is described below with referenceto FIG. 4.

FIG. 4 depicts a conceptual block diagram of an H_(∞) control lawimplementation 400 with generalized plant interconnection in accordancewith example aspects of this disclosure. The two degrees-of-freedomcontroller that is synthesized is shown by the dashed box K_(HINF).Reference commands are φ_(cmd) and θ_(cmd). Command tracking isspecified by the performance weights P_(φ) and P_(θ). Good commandtracking performance is required at low frequencies and may be relaxedat higher frequencies. Consequently, P_(φ) and P_(θ) are low-passfilters. The angular rates are condensed into a vector signal labeled p,q, r. The performance weights P_(p,q,r) are constant scalars anduniformly limit the angular rates of the aircraft across frequency. IMUmeasurement noise is incorporated into the H_(∞) synthesis by theoutput-additive weights N_(p,q,r). The effect of atmospheric turbulenceis modeled by the weight D_(elev) and is applied additively at the plantinput. The weight W_(elev) is shaped like a high-pass filter in order topenalize high frequency control commands. This helps in limiting thebandwidth of the controller. The block ACT is a low-pass filter thatmodels the actuator dynamics. All the weights used in H_(∞) synthesisare described in Table 2 below.

Robustness analysis is presented as follows. The LQG and H_(∞) synthesesresult in stable controllers that can be connected with the plant toform the closed loop. The γ value returned from the H_(∞) synthesis inthe present example is 10.85. Table 1 lists the robustness properties ofthe closed loops formed with both syntheses. The plant is denoted P andthe controller is denoted C. The MIMO gain and phase margins indicatethat the H_(∞) closed loop is more robust.

TABLE 1 Closed-loop robustness properties Property LQC closed loop H_(∞)closed loop Input Sensitivity (S_(i))  1.64 dB  3.33 dB OutputSensitivity (S_(o))  5.52 dB 22.07 dB PS_(i) 12.64 dB 10.01 dB CS_(o)−8.76 dB 17.57 dB MIMO gain margin [0.61, 1.65] [0.47, 2.11] MIMO phasemargin ±27.56° ±39.35° Critical Frequency 0.24 rad/s 3.17 rad/s

Results are discussed as follows. Flight tests of UAV 200 were conductedat the University of Minnesota Outreach, Research, and Education Parkover three days between January, 2015 and May, 2015. Each day of theflight test witnessed different wind and turbulence conditions. Thecontrol mode laws described in the previous section were developed inMatlab/Simulink and subsequently converted to C code using SimulinkCoder. The control laws are implemented within control circuitry 101(e.g., the flight computer) of UAV 200 at a sampling rate of 50 Hz. Inthis section, flight test results are presented that demonstrate safeflight using only the left elevator (E₁) of UAV 200. Similar conclusionsautomatically follow for the right elevator (E₂) due to the longitudinalsymmetry of the aircraft. Of the limited set of maneuvers introducedabove, only straight and level flight and banked turns at constantaltitude are presented. Steady descents can be executed by decreasingthe throttle. Details of use of an example LQG control mode law in theflight tests are described below with reference to FIG. 5.

FIG. 5 depicts graphs of a flight test with an LQG controller for threestraight and level flights in accordance with example aspects of thisdisclosure. The first set of results are for the LQG control lawdescribed above. FIG. 5 shows flights of UAV 200 where the aircraft wascommanded to fly straight and level at constant altitude, under controlof the LQG backup control mode controlling the one available controlsurface, the left elevator in this example. That one control surface,such as the left elevator, under control of the LQG backup control mode,is able to exert enough control on both the roll and pitch of theaircraft to maintain the aircraft in sub-optimal but stable flight.

FIG. 5 is divided into three subplots 502, 504, 506, all of which sharea common time axis. FIG. 5 shows the time histories of the roll angle,pitch angle, and left elevator command in three different subplots. Eachsubplot contains data from three different flights of UAV 200, eachshown in a different line style. The longest flight 510A lasted 29seconds and is shown as a dotted line. The second flight 510B lasted 25seconds and is shown as a solid line. The shortest flight 510C lasted 21seconds and is shown as a dashed line.

Each plot 510A, 501B, and 510C has a different end time because each ofthe three flights was of a different duration.

In addition, each of the three subplots contains a black dashed line.For the roll and pitch angle plots, the black dashed line representsreference commands: φ_(cmd) and θ_(cmd), respectively. For the leftelevator command, the black dashed line represents the trim deflection.

A primary observation from FIG. 5 is that the aircraft is stillcontrollable with a single aerodynamic control surface. Both φ and θappear to be under control and well within their respective flightenvelope bounds. Moreover, φ is between 0 and 20°, with a mean of around5°, indicating a tendency for the aircraft to roll rightwards. The onlyexception to this trend is the sudden left bank in the plot 510A neart=20 seconds. This might have been a wind gust hitting the aircraft. Theeffects of sensor noise and atmospheric turbulence can be seen in thehigh frequency content of φ. The low frequency variation in φ is morepronounced than usual, given that the aircraft is being commanded to flystraight and level.

The time response of θ, in FIG. 5, is degraded to a similar extent,relative to a standard control mode. Specifically, θ varies between 0and 30°, with a trim value of 5°. Under the control of a single surface,the aircraft has a tendency to pitch upwards. This positive pitchdeflection is seen in plots 510A, 510B, and 510C. The left elevatordeflection command is shown in the bottom subplot 506 of FIG. 5. Thetrim deflection is Ē₁=−4°. In all three flights, the left elevator iscommanded to deflect negatively. The variation in E₁ is largely between−10° and Ē₁, indicating that the left elevator never hits the saturationlimits of ±25°. The flight test results of UAV 200 performing leftbanked turns are described below with reference to FIG. 6.

FIG. 6 depicts graphs of a flight test with an LQG controller for threeleft banked turns in accordance with example aspects of this disclosure.FIG. 6 is divided into three subplots 602, 604, 606, each showing thetime history of φ, θ, and E₁. The plots 610A, 610B, and 610C representthree different flights of UAV 200 executing left banked turns. Thelongest flight 610A lasts 35 seconds and is shown as a dotted line.Flight 610B lasts 30 seconds and is shown as a solid line. The shortestflight 610C lasts 29 seconds and is shown as a dashed line. UAV 200enters into a left banked turn after a time delay of 3 seconds and staysin this turn for a total duration of 30 seconds. The corresponding bankangle command is −5°, and is shown in the plot of φ_(cmd). The pitchangle command is 5° and is unaltered from trim. As noted previously, aprimary observation from FIG. 6 is that UAV 200 is stable andcontrollable while executing left banked turns with one control surface.From FIG. 6, it is evident that the tracking performance is better whileexecuting left banked turns than while flying straight and level.

In particular, the φ response shown in FIG. 6 varies between −10° and20°. For the first 10 seconds after the start of the maneuver, φ isapproximately between 0 and 10° and does not track φ_(cmd) well.However, 10 seconds into the start of the maneuver, φ starts trackingthe command well. This delayed tracking is due to the integrators addedto the LQG synthesis. Subsequent variations in φ are within a ±5° windowcentered at φ_(cmd)=−5°. This is considered good tracking, especiallyfor an aircraft flying with a single control surface. Similarobservations can be made for the response of θ. The θ trackingperformance is poor immediately after the start of the maneuver.However, the integral action in the control law kicks in and θ starts totrack θ_(cmd) around the t=20 seconds mark. Subsequent variations in θare also within a ±5° window centered at the trim value of 5°. The leftelevator deflection command is between −15° and the trim value of −4°.In all three flights, the left elevator is commanded to deflectnegatively.

In summary, the results of this section prove that UAV 200 is stable andcontrollable even when only one aerodynamic control surface isavailable. Successful flight tests were also conducted for UAV 200performing right banked turns. This case is similar to left bankedturns. The LQG control law described above performs satisfactorily inflight. All state variables stay within, and do not depart from, theirrespective flight envelope bounds. While the overall trackingperformance is degraded relative to the standard control mode withcontrol of all control surfaces available, this is the effect associatedwith flying a handicapped aircraft. It is acknowledged that the flightduration in these examples is short (approximately 30 seconds), but thisis a promising start to more complicated flight tests. In these exampledemonstrations, the aircraft directly switches from the pilot's controlto fault-tolerant control, without ever switching to baseline control.As a consequence, several runs start with off-nominal initialconditions, leading to worse performance titan is actually the case. Ina realistic implementation of fault-tolerant control, the aircraft willswitch from baseline control. This should provide initial conditionscloser to nominal, leading to better closed loop performance.

Flight tests using an H_(∞) control mode law are described as follows.The flights described above using the LQG control law switched directlyfrom the pilot's control to the backup controller. This did not capturethe intricacies of switching from the baseline to the backup controller.The examples described in this section present a realisticimplementation of the fault-tolerant H_(∞) control law described above.The H_(∞) control mode law may involve tuning the weights of the controlmode parameters. Specifically, in an illustrative example, after thepilot engages the autopilot, the aircraft initially starts flying withthe baseline controller in the loop. Then, after a preset time delay of5 seconds, the flight computer is programmed to automatically switchfrom the baseline to the backup controller. This ensures that allaircraft states have values reasonably close to the nominal initialcondition. It is expected that this switching logic should improve theoverall performance of the fault-tolerant control. As before, thebaseline and backup controllers, and the switching logic were developedusing Matlab/Simulink. Subsequently, Simulink Coder was used forautomated C code generation.

FIG. 7 depicts graphs of a flight test with an H_(∞) controller for twostraight and level flights in accordance with example aspects of thisdisclosure. FIG. 7 shows straight and level flight of UAV 200, withH_(∞) control. As in FIGS. 5 and 6, FIG. 7 is divided into threesubplots 702, 704, 706, all of which share a common time axis. Eachsubplot 710A and 710B contains data from two different flights of UAV200, shown in dotted and dashed lines, respectively. The longer of thetwo flights 710A lasted 23 seconds and is shown as a solid line. Theshorted of the two flights 710B lasted 17 seconds and is shown as adashed line. All other notation in FIG. 7 is the same as before. Thetime scales of both flights have been shifted such that autopilotengagement starts at t=0 seconds (s). In the period t∈[0,5)s, the flightcomputer engages the baseline controller. As seen in the plots, thebaseline controller has good command tracking and distufbance rejectionproperties. At t=5 seconds, the flight computer switches to the backupH_(∞) controller for the remainder of the flight.

After the backup H_(∞) controller is engaged (t>5 s), oscillations areseen in φ, θ, and E₁. These oscillations appear to be undamped: theyneither grow nor decay in amplitude. For φ, these oscillations have anamplitude of approximately 5° and a mean close to φ_(cmd)=0. For θ,these oscillations have an amplitude of approximately 7° and a meanclose to θ_(cmd)=5°. Although the presence of these oscillations is notideal, their amplitude is small enough to not lead to loss of control(LOC). Specifically, the aircraft remains fully controllable throughoutthe duration of engagement of the H_(∞) control law. However, concerningoscillations are seen in the response of E₁. The left elevator commandappears to exceed the lower saturation bound of −25°, after the H_(∞)control law is engaged. Despite E₁ exceeding the lower saturation bound,the aircraft states are well behaved. Particularly, both φ and θ remainwithin their respective flight envelope bounds. The flight test resultsof UAV 200 performing fight banked turns using H_(∞) control aredescribed below with reference to FIG. 8.

FIG. 8 depicts graphs of a flight test with an H_(∞) controller for tworight banked turns in accordance with example aspects of thisdisclosure. FIG. 8 is organized in the same way and has the samenotation as in the previous figures, with subplots 802, 804, 806. Thelonger of the two flights 810A lasts 15 seconds and is shown as a dottedline. The shorter of the two flights 810E lasts 9 seconds and is shownas a dashed line. UAV 200 enters into a right banked turn after a timedelay of 6 seconds and stays in this turn for the remainder of themaneuver. The corresponding bank angle command is +10°. As before, theflight computer first runs the baseline controller for t∈[0,5)s. At t=5seconds, the flight computer switches to the H_(∞) controller. From theφ response, it is seen that command tracking is faster with the H_(∞)controller. The rise time for φ is 1 second. Oscillations, of similarmagnitudes as before, are seen in the φ and θ responses. It isconcerning that oscillations in θ reach −30°. However, the aircraftremains fully controllable and no LOC event occurs. As before, E₁appears to exceed the lower saturation bound of −25°.

In summary, the H_(∞) backup control mode or control law allows for UAV200 to continue flying even with one control surface. That one controlsurface, such as the left elevator, under control of the H_(∞) backupcontrol mode, is able to exert enough control on both the roll and pitchto maintain the aircraft in sub-optimal but stable flight. Theoscillations seen in FIGS. 7 and 8 can be mitigated by reselecting theweighting functions used in the H_(∞) synthesis. Specifically, a higherpenalty can be imposed on control surface usage by retuning the weightW_(elev) in FIG. 4. In addition, better weight selection can reduce, oreven avoid, the oscillations seen in φ, θ, and E₁.

This disclosure introduces the concept of safely flying an aircraftusing only one aerodynamic control surface. Two inner-loop controllerswere flight tested to perform banked as well as straight and levelmaneuvers. Both controllers performed satisfactorily in the flighttests. In the best-case scenario, both controllers are able to trackroll and pitch reference commands to within five degrees of tolerance.The tracking performance is influenced by atmospheric conditions. Thisdemonstration highlights the potential for applying robust controltheory in designing fault-tolerant controllers. In particular, advancedfeedback control can he used to stabilize an aircraft even under extremefault scenarios, such as a single functional control surface.

FIG. 9 depicts a flowchart for a method 900 that may be performed by anaircraft control system in accordance with example aspects of thisdisclosure. In one example, aircraft control circuitry 101 of FIG. 1detects the state of one or more flight control surfaces of an aircraft,such as UAV 100 or UAV 200 (902). Control circuitry 101 determines thatat least one of the one or more flight control surfaces are notoperating nominally (904). In one example, control circuitry 101determines that at least one of the one or more flight control surfaceshave failed or are inoperable. In response to detecting that one or moreof the flight control surfaces of the aircraft are not operatingnominally, control circuitry 101 switches to a backup control modeconfigured to operate the aircraft in flight with non-nominaloperability of one or more control surfaces of the aircraft (906).Further, control circuitry 101 incorporates the detected state of theone or more flight control surfaces into the backup control mode (908).For example, control circuitry 101 determines control schema to safelyoperate UAV 100 or UAV 200 without the use of the one or more flightcontrol surfaces that are not operating nominally. In another example,control circuitry 101 determines control schema to safely operate UAV100 or UAV 200 with only a single operable flight control surface, inthe event that all the remaining flight control surfaces are stuck attheir respective trim positions. Control circuitry 101 operates theaircraft in the backup control mode (910). In some examples, controlcircuitry 101 implements a safe return and land procedure for UAV 100 orUAV 200 with the remaining operable flight control surface or surfaces.

Example Linear Aircraft Model Parameters.

The nominal trim point for UAV 200 is given by the pair (x, ū), whereV=23 ms⁻¹, α=5.2°, β=0°, φ=0, θ=5.2°, p=q=r=0, τ=0.5, E₁=E₂=−5.08°,R1=R2=0, −A1=A2=−0.3°, and F1=F2=0. Note that the elevator trim of−5.08° corresponds to the angle of attack of 5.2°. The aileron trim of−0.3° is used to compensate for the torque from the electric motor. Thenonlinear aircraft model is linearized at this nominal trim point. Thestate-space matrices of the linear model (P) are aiven in equation 10.

$\begin{matrix}{P:={\quad{\begin{bmatrix}A & B \\C & D\end{bmatrix} = {\lbrack \begin{matrix}0 & 0 & 1 & 0 & 0.09 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & {- 9.5} & 0.058 & 2.4 & 0.001 & {- 1.6} & 0 & 8.1 \\0 & 0 & 0 & {- 7.8} & 0.42 & 0.39 & {- 0.026} & {- 2.2} & {- 39} \\0 & 0 & 0.58 & {- 0.26} & {- 1.7} & 0 & 0.69 & 0 & {- 0.93} \\0 & {- 9.8} & 0 & {- 2.1} & 0 & {- 0.32} & {- 0.11} & 0.83 & 0.39 \\9.8 & 0 & 2.1 & 0 & {- 23} & 0 & {- 0.43} & 0 & 0 \\0 & {- 0.89} & 0 & 23 & 0 & {- 0.33} & {- 0.096} & {- 5.7} & {- 4.6} \\1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0\end{matrix} \rbrack\quad}}}} & (10)\end{matrix}$

Example LQG Synthesis Parameters.

The maximum values for the states are defined as: φ_(max)=θ_(max)=5°,p_(max)=q_(max)=r_(max)=10° s⁻¹, and(u_(max),v_(max),w_(max))=(5,0.87,0.44)ms⁻¹. The maximum value for thecontrol surface deflection is defined as: E1_(max)=50°. The matrices Qand R that appear in equation 9 are defined as shown in equations 11 and12.

Q=diag(φ_(max) ⁻²,θ_(max) ⁻²ρ_(max) ⁻² ,q _(max) ⁻² ,r _(max) ⁻² ,u_(max) ⁻² v _(max) ⁻² ,w _(max) ⁻²)   (11)

R=E1_(max) ⁻²   (12)

The covariance of the state variables are defined as:φ_(cov)=θ_(cov)=5×10⁻⁴rad²,p_(cov)=q_(cov)=r_(cov)=5×10⁻⁵rad²s⁻²,u_(cov)=v_(cov)=w_(cov)=0.05m²/s². The covariance of the process noise (w) and measurement noise (v)signals are defined as shown in equations 13 and 14.

E[ww ^(T)]=diag(φ_(cov),θ_(cov) ,p _(cov) ,q _(cov) ,r _(cov) ,u _(cov),v _(cov) ,w _(cov))   (13)

E[vv ^(T)]=diag(φ_(cov),θ_(cov) ,p _(cov) ,q _(cov) ,r _(cov))   (14)

The integral gains used for command tracking are −8 in the φ channel and−6 in the θ channel.

Example H_(∞) Synthesis Parameters.

The weighting functions for the H_(∞) synthesis are listed in table 2.

TABLE 2 Weighting functions used in H_(∞) synthesis Weight Value P_(φ)$\frac{{0.1s} + 5.973}{s + 0.176}$ P_(θ)$\frac{{0.1s} + 12.03}{s + 6.766}$ P_(p,q,r) 5.73 I₃ N_(p,q,r) 0.1 I₃D_(elev) 0.01 W_(elev) $\frac{{1.423s} + 76.31}{s + 11.92}$ ACT$\frac{50.27}{s + 50.27}$

FIG. 10 is an illustration of example control circuitry 101 of anaircraft, such as UAV 100 of FIG. 1 or UAV 200 of FIGS. 2A-2B, inaccordance with the techniques of the disclosure. In some examples,controller 101 includes sensor(s) 1002, which detects a state of one ormore flight control surfaces of UAV 100 or UAV 200. One or more sensor1002 provides an input to processing circuitry 1004, which, based oninstructions stored in memory 1006, provides a control signal 1008 toone or more flight control surface actuators for controlling the flightof UAV 100 or UAV 200.

Sensors 1002 are sensors capable of detecting the function ornon-function of at least one flight control surface of UAV 100 or UAV200. In some examples, sensors 1002 include one or more IMUS, such as astrap-down IMU. In other examples, sensors 1002 include one or morecontrol surface sensors, such as one or more of a potentiometer, aposition sensor, an optical encoder, a strain gauge, or a thermalsensor. Sensors 1002 may further include one or more global positioningsystem units (GPSs), airdata proves, gyroscopes, accelerometers, or tiltsensors.

In some examples, processing circuitry 1004 is one or moremicroprocessors, digital signal processors (DSPs), application specificintegrated circuits (ASICs), field programmable gate arrays (FPGAs), orany other equivalent integrated or discrete logic circuitry, as well asany combinations of such components. Processing circuitry 1004 mayincorporate one or more flight control computers that determine, basedon input from sensors 1002, a control signal 1008 to safely control theflight of UAV 100 or UAV 200 with at least one flight control surfaceand output control signal 1008 to one or more flight control surfaceactuators.

In some examples, memory 1006 stores instructions with which processingcircuitry 1004 may determine control signal 1008. Further, memory 1006may be random access memory (RAM), read only memory (ROM), programmableread only memory (PROM), erasable programmable read only memory (EPROM),electronically erasable programmable read only memory (EEPROM), flashmemory, comprising executable instructions for causing the one or moreprocessors to perform the actions attributed to them. Further, thismemory may be implanted entirely in hardware, software, or a combinationthereof.

According to the techniques of the disclosure, processing circuitry 1004operates the UAV in a baseline control mode when all control surfacesare healthy. In one example, processing circuitry 1004 detects, based oninput from control surface sensors of sensors 1002, a fault in one ormore flight control surfaces of the UAV, In response to detecting thatthe one or more flight control surfaces of the UAV are not operatingnominally, processing circuitry 1004 switches to a backup control modeconfigured to operate the UAV in flight with non-nominal operability ofthe one or more of the control surfaces of the UAV.

In one example, while in the backup control mode, processing circuitry1004 receives input from other types of sensors 1002 for safelycontrolling the flight of UAV. In one example, processing circuitry 1004receives input from one or more IMUS, GPS receivers, and airdata probesof sensors 1002, and based on this input, provides a control signal 1008to at least one nominal flight control surface actuator for safelycontrolling the flight of the UAV despite that the one or more flightcontrol surfaces of the UAV are not operating nominally. In someexamples, processing circuitry 1004 provides a control signal 1008 tothe one or more flight control surfaces of the UAV that are notoperating nominally to lock the one or more flight control surfaces ofthe UAV that are not operating nominally in their respective trimpositions, In some examples, processing circuitry 1004 provides acontrol signal 1008 to a single nominal flight control surface actuatorand safely controls the flight of the UAV via a single nominal flightcontrol surface.

In one example, the techniques of the disclosure describe acomputer-readable medium comprising instructions for causing aprogrammable processor to: detect whether flight control surfaces of anunmanned aerial vehicle (UAV) are operating nominally; switch, inresponse to detecting that one or more of the flight control surfaces ofthe UAV are not operating nominally, to implementing a backup controlmode configured to operate the UAV in flight with non-nominaloperability of one or more control surfaces of the UAV; and operate theUAV in the backup control mode.

In a further example, the techniques of the disclosure describe theabove computer-readable medium, wherein, to operate the UAV in thebackup control mode, the instructions further cause the processor toimplement a return and land procedure for the UAV.

In a further example of the above computer-readable medium, theinstructions further cause the programmable processor to: initiallyoperate the UAV in a standard control mode. and detect whether theflight control surfaces of the UAV are operating nominally at least onceduring operating the UAV in the standard control mode.

In another example, the techniques of the disclosure describe a methodcomprising: detecting, by one or more processors of a controller withinan unmanned aerial vehicle (UAV), that one or more flight controlsurfaces of the UAV are malfunctioning; switching, by the one or moreprocessors, in response to detecting that the one or more flight controlsurfaces of the UAV are malfunctioning, to implementing a backup controlmode configured to operate the UAV in flight by maintaining the UAV inflight by operating one or more remaining functioning control surfacesof the UAV; and maintaining, by the one or more processors, the U AV inflight by operating the one or more remaining functioning controlsurfaces of the UAV.

In another example, the techniques of the disclosure describe a methodcomprising: detecting, by one or more processors of a controller withinan aircraft, whether flight control surfaces of the aircraft areoperating nominally; switching, by the one or more processors, inresponse to detecting that one or more of the flight control surfaces ofthe aircraft are not operating nominally, to implementing a backupcontrol mode configured to operate the aircraft in flight withnon-nominal operability of one or more of the control surfaces of theaircraft; and operating, by the one or more processors, the aircraft inthe backup control mode.

In a further example of the above method, operating the aircraft in thebackup control mode comprises operating the aircraft in flight withoperability of only a single nominal control surface of the aircraft.

In a further example of the above method, the aircraft is a mannedaircraft.

The techniques described in this disclosure may be implemented, at leastin part, in hardware, software, firmware or any combination thereof. Forexample, various aspects of the described techniques may he implementedwithin one or more processors, including one or more microprocessors,digital signal processors (DSPs), application specific integratedcircuits (ASICs), field programmable gate arrays (FPGAs), or any otherequivalent integrated or discrete logic circuitry, as well as anycombinations of such components. The term “pmcessor” or “processingcircuitry” may generally refer to any of the foregoing logic circuitry,alone or in combination with other logic circuitry, or any otherequivalent circuitry. A control unit comprising hardware may alsoperform one or more of the techniques of this disclosure.

Such hardware, software, and firmware may he implemented within the samedevice or within separate devices to support the various operations andfunctions described in this disclosure. In addition, any of thedescribed units, modules or components may be implemented together orseparately as discrete but interoperable logic devices. Depiction ofdifferent features as modules or units is intended to highlightdifferent functional aspects and does not necessarily imply that suchmodules or units must be realized by separate hardware or softwarecomponents. Rather, functionality associated with one or more modules orunits may be performed by separate hardware or software components, orintegrated within common or separate hardware or software components.

The techniques described in this disclosure may also be embodied orencoded in a computer-readable medium, such as a computer-readablestorage medium, containing instructions. Instructions embedded orencoded in a computer-readable storage medium may cause a programmableprocessor, or other processor, to perform the method, e.g., when theinstructions are executed. Computer readable storage media may includerandom access memory (RAM), read only memory (ROM), programmable readonly memory (PROM), erasable programmable read only memory (EPROM),electronically erasable programmable read only memory (EEPROM), flashmemory, a hard disk, a CD-ROM, a floppy disk, a cassette, magneticmedia, optical media, or other computer readable media.

Various embodiments of the invention have been describe(These and otherembodiments are within the scope of the following claims.

What is claimed is:
 1. A method comprising: detecting, by one or moreprocessors of a controller within an unmanned aerial vehicle (UAV),whether flight control surfaces of the UAV are operating nominally;switching, by the one or more processors of the controller, in responseto detecting that one or more of the flight control surfaces of the UAVare not operating nominally, to implementing a backup control modeconfigured to operate the UAV in flight with non-nominal operability ofone or more of the control surfaces of the UAV; and operating, by theone or more processors of the controller, the UAV in the backup controlmode.
 2. The method of claim 1, wherein operating the UAV in the backupcontrol mode comprises operating the UAV in flight with operability ofonly a single nominal control surface of the UAV.
 3. The method of claim2, wherein operating the UAV in the backup control mode furthercomprises: actuating only the single nominal control surface of the UAV;and locking one or more non-nominal control surfaces of the UAV into arespective trim position fbr the one or more non-nominal controlsurfaces of the UAV.
 4. The method of claim wherein implementing thebackup control mode comprises: detecting, by the one or more processors,a state of the one or more of the flight control surfaces of the UAVthat are not operating nominally; and incorporating, by the one or moreprocessors, the detected state of the one or more of the flight controlsurfaces of the UAV that are not operating nominally in the backupcontrol mode.
 5. The method of claim 1, wherein implementing the backupcontrol mode comprises modifying, by the one or more processors andbased on the one or more of the flight control surfaces of the UAV thatare not operating nominally, control parameters for roll rate (p), pitchrate (q), and yaw rate (r) in an aircraft control linear model.
 6. Themethod of claim 1, wherein itnplementing the backup control modecomprises modifying, by the one or more processors, the parameters of aflight control law; and wherein operating the UAV in the backup controlmode comprises operating, based on the modified parameters of the flightcontrol law, the UAV.
 7. The method of claim 6, wherein the flightcontrol law is designed using a linear quadratic Gaussian (LQG) controldesign technique.
 8. The method of claim 6, wherein the flight controllaw is designed using an H infinity (H_(∞)) control design technique. 9.The method of claim 1, wherein implementing the backup control modecomprises using a Kalman filter to minimize steady-state covariance oferror in state estimates of a linearized aircraft model in a state-spacerepresentation.
 10. The method of claim 9, wherein using the Kalmanfilter to minimize the steady-state covariance of the error in the stateestimates comprises determining an optimization in accordance withminimize$( {\lim\limits_{tarrow\infty}{E\lbrack {( {x - \hat{x}} )( {x - \hat{x}} )^{T}} \rbrack}} ).$11. The method of claim 9, wherein the Kalman filter is a stateestimator of a linear quadratic Gaussian (LQG) model.
 12. The method ofclaim 1, wherein implementing the backup control mode comprises using astate estimator of an H infinity (H_(∞)) controller.
 13. The method ofclaim 1, wherein operating the UAV in the backup control mode comprisesimplementing a return and land procedure for the UAV.
 14. The method ofclaim 1, further comprising: initially operating the UAV in a standardcontrol mode, wherein detecting whether the flight control surfaces ofthe UAV are operating nominally is performed at least once duringoperating the UAV in the standard control mode.
 15. An unmanned aerialvehicle (UAV) comprising: a plurality of flight control surfaces; and acontrol system comprising memory and at least one processor, the atleast one processor configured to: detect whether one or more flightcontrol surfaces of the plurality of flight control surfaces of the UAVis operating nominally; upon detecting that the one or more flightcontrol surfaces of the plurality of flight control surfaces of the UAVis not operating nominally, implement a backup control mode configuredto operate the UAV in flight with non-nominal operability of the one ormore flight control surfaces of the plurality of flight control surfacesof the UAV; and operate the UAV in the backup control mode.
 16. Controlcircuitry for an unmanned aerial vehicle (UAV) comprising memory and atleast one processor configured to: detect whether flight controlsurfaces of the UAV are operating nominally; switch, in response todetecting that one or more of the flight control surfaces of the UAV arenot operating nominally, to implementing a backup control modeconfigured to operate the UAV in flight with non-nominal operability ofone or more control surfaces of the UAV; and operate the flight controlsurfaces of the UAV in the backup control mode.
 17. The controlcircuitry of claim 16, wherein, to operate the UAV in the backup controlmode, the at least one processor operates the UAV in flight withoperability of only a single nominal control surface of the UAV.
 18. Thecontrol circuitry of claim 17, wherein, to operating the UAV in thebackup control mode, the at least one processor is further configuredto: actuate only the single nominal control surface of the UAV; and lockone or more non-nominal control surfaces of the UAV into a respectivetrim position for the one or more non-nominal control surfaces of theUAV.
 19. The control system of claim 16, further configured to: detect astate of the one or more of the flight control surfaces of the UAV arenot operating nominally; and incorporate the detected state of the oneor more of the flight control surfaces of the UAV that are not operatingnominally in the backup control mode.
 20. The control system of claim16, wherein, to implement the backup control mode, the at least oneprocessor is further configured to modify control parameters for rollrate (p), pitch rate (q), and yaw rate (r) in an aircraft control linearmodel.
 21. The control system of claim 16, wherein, to implement thebackup control mode, the at least one processor is further configured tomodify the parameters of a flight control law; and wherein, to operatethe UAV in the backup control mode, the at least one processor isfurther configured to operate, based on the modified parameters of theflight control law, the UAV.
 22. The control system of claim 21, whereinthe flight control law is designed using an H infinity (H_(∞)) controldesign technique.
 23. The control system of claim 21, wherein the flightcontrolis designed using a linear quadratic Gaussian (LQG) controldesign technique.
 24. The control system of claim 16, wherein, toimplement the backup control mode, the at least one processor is furtherconfigured to use a Kalman filter to minimize steady-state covariance oferror in state estimates of a linearized aircraft model in a state-spacerepresentation.
 25. The control system of claim 24, wherein using theKalman filter to minimize the steady-state covariance of the error inthe state estimates comprises determining an optimization in accordancewith minimize$( {\lim\limits_{tarrow\infty}{E\lbrack {( {x - \hat{x}} )( {x - \hat{x}} )^{T}} \rbrack}} ).$26. The control system of claim 25, wherein the Kalman filter is a stateestimator of a linear quadratic Gaussian (LQG) model.
 27. The controlsystem of claim 25, wherein, to implement the backup control mode, theat least one processor is configured to use a state estimator of an Hinfinity (H_(∞)) controller.
 28. The control system of claim 16,wherein, to operate the UAV in the backup control mode, the at least oneprocessor is configured to implement a return and land procedure for theUAV.
 29. The control system of claim 16, wherein the at least oneprocessor is configured to: initially operate the UAV in a standardcontrol mode, and detect whether the flight control surfaces of the UAVare operating nominally at least once while operating the UAV in thestandard control mode.
 30. A computer-readable medium comprisinginstructions for causing a programmable processor to: detect whetherflight control surfaces of an unmanned aerial vehicle (UAV) areoperating nominally; switch, in response to detecting that one or moreof the flight control surfaces of the UAV are not operating nominally,to implementing a backup control mode configured to operate the UAV inflight with non-nominal operability of one or more control surfaces ofthe UAV; and operate the UAV in the backup control mode.
 31. Thecomputer-readable medium of claim 30, wherein the instructions furthercause the programmable processor to: detect a state of the one or moreof the flight control surfaces of the UAV are not operating nominally;and incorporate the detected state of the one or more of the flightcontrol surfaces of the UAV that arc not operating nominally in thereduced flight control surface operability control mode.
 32. Thecomputer-readable medium of claim 30, wherein, to implement the backupcontrol mode, the instructions further cause the processor to modifycontrol parameters for roll rate (p), pitch rate (q), and yaw rate (r)in an aircraft control linear model.
 33. The computer-readable medium ofclaim 30, wherein, to implement the backup control mode, theinstructions further cause the processor to use a Kalman filter tominimize steady-state covariance of error in state estimates of alinearized aircraft model in a state-space representation.